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IN THE CLAIMS 

Please amend the claims as follows: 

1 . (Previously presented) A method for filtering out exploits passing through a 
device, comprising: 

receiving an object directed to the device; 
determining a first hash value associated with the object; 
determining a second set of hash values associated with objects that have 
previously been scanned; 

if the first hash value matches at least one of the hash values in the second set, 
determining a third hash value associated with the object; 
determining a fourth set of hash values associated with the objects that have 
previously been scanned; and 

if the third hash value matches at least one of the hash values in the fourth set, 
immediately processing the object. 

2. (Canceled) 

3. (Canceled) 

4. (Previously presented) The method of Claim 1, wherein the first hash value 
includes a rough outline hash value (ROHV). 

5. (Previously presented) The method of Claim 4, wherein the third hash value 
includes a sophisticated signature hash value (SSHV) and wherein the ROHV requires less time 
to compute than the SSHV. 

6. (Previously presented) The method of Claim 1, wherein immediately processing 
the object further comprises forwarding the object to an output component without scanning the 
object. 
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7. (Canceled) 

8. (Previously presented) The method of Claim 6, wherein immediately processing 
the object further comprises forwarding the object to a destination. 

9. (Previously presented) The method of Claim 1, further comprising if the first hash 
value does not match any of the hash values in the second set, 

scanning the object for an exploit; and 

updating the second set of hash values to include the first hash value. 

10. (Previously presented) The method of Claim 1 , further comprising if the third 
hash value does not match any of the hash values in the fourth set, 

scanning the object for an exploit; and 

updating the fourth set of hash values to include the third hash value. 

11. (Canceled) 

12. (Previously presented) A computer-readable medium encoded with a data- 
structure, comprising: 

a first indexing data field having indexing entries, each indexing entry including a first 
hash value; and 

a second data field including object-related entries, each object-related entry having a 
second hash value and being indexed to an indexing entry in the first indexing data field, each 
object-related entry being uniquely associated with an object that has been previously scanned. 

13. (Canceled) 

14. (Previously presented) The computer-readable medium of Claim 12, wherein the 
first hash value is a rough outline hash value (ROHV). 
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1 5 (Previously presented) The computer-readable medium of Claim 1 2, wherein the 
second hash value is a sophisticated signature hash value (SSHV). 

1 6. (Original) The computer-readable medium of Claim 1 2, wherein at least one 
object-related entry in the second data field includes information about the associated object. 

17. (Currently amended) A system embodied on a computer-readable medium 
encoded with a data-structure for protecting a device against an exploit, comprising: 

a message tracker that is configured to determine whether an object has been previously 
scanned using a two-phase hash value technique; and 

a scanner component that is coupled to the message tracker and that is configured to 
receive an unscanned object and to determine whether the unscanned object includes an exploit. 

18. (Canceled) 

1 9. (Previously presented) The system of Claim 1 7, wherein the two-phase hash value 
technique comprises: 

determining a first hash value associated with the object; 

determining a second set of hash values associated with objects that have previously been 
scanned; and 

if the first hash value does not match at least one of the hash values in the second set, 
determining that the object has not been previously scanned. 

20. (Canceled) 

21 . (Previously presented) The system of Claim 1 9, wherein the first hash value 
further comprises a ROHV. 

22. (Previously presented) The system of claim 19, wherein the two-phase hash value 
technique further comprises: 
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if the first hash value matches at least one of the hash values in the second set, 

determining a third hash value associated with the object; 

determining a fourth set of hash values associated with the objects that have 
previously been scanned; 

if the third hash value does not match at least one of the hash values in the fourth 
set, determining that the object has not been previously scanned. 

23. (Canceled) 

24. (Previously presented) The system of Claim 22, wherein the third hash value 
further comprises a SSHV. 

25. (Previously presented) The system of Claim 22, wherein the two-phase hash value 
technique further comprises: 

if the third hash value approximately matches at least one of the hash values in the 
fourth set, determining that the object has been previously scanned, 

26-29. (Canceled) 

30. (Currently amended): The method of Claim 1 , wherein: 

the first hash value and third hash second value are determined by the device; and 
the second set of hash values and the fourth set of hash values are determined by the 
device based on previous scanning by the device. 

31. (Previously presented): The method of claim 1, wherein the method is performed 
by a firewall. 



32. 

by a router. 



(Previously presented): The method of claim 1, wherein the method is performed 
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33. (Previously presented): The method of claim 1, further comprising: 
determining whether the object is compressed; and 

if the object is compressed, decompressing the object. 

34. (Previously presented): The system of claim 17, wherein the system includes a 
firewall 



35. (Previously presented): The system of claim 17, wherein the system includes a 

router. 

36. (Previously presented): A method comprising: 
receiving an object; 

matching a rough outline hash value (ROHV) of the object to ROHVs of known objects; 

if a match is found between the ROHV of the object to any of the ROHVs of the known 
objects, matching a sophisticated signature hash value (SSHV) of the objects to SSHVs of the 
known objects; 

if a match is found between the SSHV of the object to any of the SSHVs of the known 
objects, processing the object as a malicious object; 

if a match is not found between either the ROHV of the object to any of the ROHVs of 
the known objects or the SSHV of the object to any of the SSHVs of the known objects, 
scanning the object; and 

if the scanning the object determines that the object is malicious, processing the object as 
a malicious object and updating the ROHVs of known objects and the SSHVs of the known 
objects. 

37. (New): The method of claim 1, wherein the determining the first hash value 
includes determining a rough outline hash value (ROHV) based on a hash value of a first portion 
of the object. 
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38. (New): The method of claim 37, wherein determining the third hash value 
includes determining a sophisticated signature hash value (SSHV) based on a Message Digest -5, 
a Secure Hash Algorithm, or a Secure Hash Standard, and wherein the ROHV requires less time 
to compute than the SSHV. 

39. (New); The computer-readable medium of Claim 12, wherein the first hash value 
is a rough outline hash value (ROHV) determined based on a hash value of a first portion of the 
object. 

40. (New); The computer-readable medium of Claim 12, wherein the second hash 
value is a sophisticated signature hash value (SSHV) determined based on a Message Digest -5, a 
Secure Hash Algorithm, or a Secure Hash Standard. 

41. (New): The system of Claim 19, wherein the first hash value further comprises a 
ROHV determined based on a hash value of a first portion of the object. 

42. (New): The system of Claim 22, wherein the third hash value further comprises a 
SSHV determined based on a Message Digest -5, a Secure Hash Algorithm, or a Secure Hash 
Standard. 



43. (New): The method of claim 36, wherein: 

the ROHV is determined based on a hash value of a first portion of the object; and 
the SSHV is determined based on a Message Digest -5, a Secure Hash Algorithm, or a 
Secure Hash Standard. 



